1070213 - Review SecurityDomain implementation

Status: RESOLVED INCOMPLETE

(Firefox Graveyard :: Shumway, defect)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

This is a page containing very basic tests of cross-domain loaded SWFs scripting each other. The ability to safely load and permit cross-domain SWF scripting is a feature that will be required to support ads and other types of content that utilize a parent loading SWF.

http://people.mozilla.org/~mwobensmith/flash/sandbox/

Currently, Shumway does not sandbox SWFs by domain and therefore has no permission mechanism to test.

Examples here are AVM1 and AVM2, and simply check to see if they can read a variable across a domain boundary.


Not tested:
- Anything other than allowDomain("*")
- Cross-protocol scripting
- Redirects
- Other types of data access

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Attachment: parent_files.zip

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

Attachment: child_files.zip

Comment 3

[Chris Peterson [:cpeterson]]

Affects dynamically loaded ads.

Comment 4

[Till Schneidereit [:till]]

Matt, could you perhaps put a crossdomain.xml file on both domains allowing access to each other? I know that it's not required for your test case in the Flash plugin, but it would make testing easier for us as long as we have the "only load SWFs from domains that allow data loading" restriction in place.

We have SecurityDomains implemented, and I'd like to test how well they work.

Comment 5

[Matt Wobensmith [:mwobensmith][:matt:]]

Hi Till - I'm happy to do so.

Obviously there are many ways to configure policy files. Create the policy files you want to test with and get them to me (here in the bug or send to me directly) and I'll stage them ASAP. 

Make sure to specify if you want them in a given directory or in the root - or both.

Thanks.

Comment 6

[Till Schneidereit [:till]]

Great, thanks!

We only want to test the SecurityDomain functionality here, so the crossdomain.xml file can just allow everything: it doesn't matter much. Either "*" or the other SWF's domain would be great.

Comment 7

[Matt Wobensmith [:mwobensmith][:matt:]]

OK, will do. Is this a root policy file? Or in the same directory as the SWF?

Comment 8

[Till Schneidereit [:till]]

(In reply to Matt Wobensmith from comment #7)
> OK, will do. Is this a root policy file? Or in the same directory as the SWF?

A root file would be great. I'm not sure we already support the same-directory version.

Comment 9

[Matt Wobensmith [:mwobensmith][:matt:]]

I've put a permissive policy file at:

http://mattdev.orgfree.com/flash/sandbox/crossdomain.xml

So, SWFs that load from the parent domain of people.mozilla.org should be working.

However, I can't put root policy files on people.mozilla.org because I don't control that domain, so tests here where the child wants to access the parent won't work. 

If this is enough to validate your work on SecurityDomains, great. I suspect, though, that for more testing you'll need to emulate multi-domain data access, as well as HTTPS and all of the directives that can be used in a policy file. Sadly that is more than I can provide at this time, but would be happy to work with you on that in the future.

Comment 10

[Matt Wobensmith [:mwobensmith][:matt:]]

Oops, correction:

I've put a permissive policy file at:

http://mattdev.orgfree.com/crossdomain.xml

And not in the directory mentioned above.

Otherwise, all other comments are the same.